Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Presentation: Installed a 2nd HDD (Exclusively for daily backups - ironic!) I did manage to fire off one Backup with win 7 backup including an image, but I doubt it is clean. Then next morning the computer was no longer in WIN7 environment but had rebooted to System Repair Panel, and despite a week of working on the problem with lots of pro and sub-pro advice online and offline, I could not get the startup repair to stop reporting that my code integrety file"C:\ci.dll" was corrupt and it could not help me. I was locked in a loop [boot start->system repair]. Safe mode, bios changes/resets, drive removals rearrangments, win7 orig DVD repair, triple startup repair cycle, replacing ci.dll w/ correct sized version (which simply reverted to "corrupt size on reboot"), restore points, using the one imagefile i had made .... no help - all roads lead to the sys rec panel.

Positive (hopefully) Headway I've Made: I researched the details of the component library ci.dll and looked for a vulenerability or weakness I could exploit to avoid the error, and I learned it doesn't lend it's function set during kernel debug mode and unsigned drive ignore mode, I Immediately tryed the latter and was in windows 7 like noting had ever happened (superficially anyway).

Cause(s): Although I am unaware out the timeline/origin of the malicious event, a trojan appaerntly infiltrated my Win7/home/64 system's defences and left plently of malware components across the filesystem, most notable is a rootkit the MBR, named TROJAN:Win32/Alureon.DX, Also present was TROJAN:Win32/Alureon.A, i believe they work "together" so to speak.

AVG reident sheild took pleny of notes as it watched ~20 "trojens" execute as "setup.exe" from temp folders as well as the main malware file (name not availble at this time) I ran a full rootkit scan w/AVG - ~15 results (one main and the rest named after the win32 smoke and mirrors command they impliment (i.e. FILE_LIST_REQUEST, ALTER_USER_PERMISSION). OF course AVG can't help with these so I ran MS System Security Sweeper from a newly reconnected DVD and a full scan produced the two malwares (TROJAN:Win32/Alureon.A & TROJAN:Win32/Alureon.DX) using the MS sweeper's nomeclature, but I'm hoping it's the same code.

Currently: So after stairing at the screen (letters MBR) for 10 min or so I reluctantly instructed Sweeper to remove both. and it reported sucess. I did a full scan w/sweeper afterwords, and it reported not problems. I powered off and have not rebooted since as not to reactivate any viral safegurard it may have had implemented for just that type of removal! Thats where I am now.

I still worry it was not removed in it's entirety, or it left the Master Boot Record or other boot files corrupt. I would prefer a thourough step-by-step guide from someone of knowledge, befoe I go trying to rebuild/fix MBR from a WinRE cmd prmpt or use ineffective software. I know this malware is known at boot-time to dup itself @random location and alter reg entrys to boot the currently unexecuting clone, so removing it should have no noticable effect unless both copys are located. It's known for altering hosts file...not on m computer, but internet setting ...yes all kinds of prompts and alterd settings in IE reg keys. And it's known for stealing (changing) one's DNS lookup tables and online DNS ref connection (and flusing dnsbuffers for quick affect). I mention these only out of fear that something get's overlooked, but I'll get to the end since this is the short version, (HA).

I only wish I could work on it inertly from another computer, via usb etc, but i cant find any of my sata->usb adapters, and thumbdrives are filled 1/2way with other backed up data files i removed using xcopy cmd which i will keep as a second chance if everything falls apart now, although i do not have all the vital files, so i'd REALLLLLY like to not do a wipe/reinstall.

Thanks for the listening to the long explination and spelling errors,
Mike

I powered off and have not rebooted since as not to reactivate any viral safegurard it may have had implemented for just that type of removal! Thats where I am now.

Mike, I just had a read again, and whilst we wait for Jacee/Corinne to offer some advice, I thought I might make a suggestion.

Since, you are concerned about possible remnants remaining, and you do not wish to boot this disk into Windows, you might want to try with a bootable anti-virus disk. I have used F-Secure in the past to clean out some less troublesome trojans than yours:

While there are some 'specialists' who will work on a Rootkit infected computer ... I am not one of them. My advice is to wipe and do a clean install. If that isn't done, then how can you ever trust your computer to be stable again?

Thanks, i've been considering a linux dvd boot, and a friend rec'd it to me too, I just was hoping to here an answer just a little bit better (perfectionist type thing) but there is no correct answer except for what I was fearfully anticipating - just what Jacee said...

Nice to meet you. I own a computer repair biz and thats what I tell all my customers too, because you are absolutly right, a 100% wipe / reformat / and reinstall is the only way to "cure" most malware and be sure you are good! But this, being a sticky situation, I think I need to do this. The computer belongs to my absolute best VIP customer, friend and formr boss, an attorney that has no backups whatsoever except the one I made "as" the attack was likely underway, so I would not feel safe reloading the files from there or the flash card I xcopyed post-attack. This guy isn't a blood sucker lawer, he's a will's and trusts kinda atty practiced over 30 years and this is every file he has on his clients (pretty stupid I reaalize, but nonetheless, I will not let him get disbarred or even jailedfor neglecting to secure the files.

Not to go on about the reason for my "nobel cause" crusade, but I'm basically saying this... I NEED to reload the files from that flash drive, so since any portion of that could be contaminated, there is no truely sterile path back to fix the computer "in whole", I will then have to settle for the best I can get. Your advice I have no disagreements with, it's spot on.

I can't afford a "specialist", I just would like someone, that has possibly delt with this or a similarly virulant strand of beast, more than one time hopefully! I'm not trying to talk you into helping me, but if someone else reads this or you know someone or a good soure, Id be better off. I am fairly computer literate (I get down into the low-level MSAM and C++ mostly, and like I said fix computers for a living (The Reliable Computer Guy, LLC) So I will try it on my own if i can't find help, albeit outside of my comfort zone, as I usually do the reinstall for everyone else.

Anything?
Anyone?
Don't be afraid to "chime in" !

Thanks for the original reply, and as of now the add'l reading of my rant!
Mike

and I have always had such good luck w/ avg free ed. catching viri on client's computers and keeping them nice and spotless, aside from the preformance ataxia that I hate!, I think I'll be loading new anti s/w in my customers and friends computers after this one incident.

While there are some 'specialists' who will work on a Rootkit infected computer ... I am not one of them. My advice is to wipe and do a clean install. If that isn't done, then how can you ever trust your computer to be stable again?

--------------------------------------------------------------
After that great read on Rootkit I would do a wipe and a new intall just like Jacee recommended. How else would one know the Rootkit is completely gone. If you did a format and install with out doing a wipe the Rootkit could just install it's self again and you might not know it.

Require (Rootkit.TDSS.TDL4) Rootkit Removal & Cleanup walkthrough

Power icon missing after removal ZeroAccess rootkitI removed this nasty from my cousin's laptop about 5 months ago w/ a combination of RKill, Farbar's Service Scanner, Eset Sirifef tool & services repair, ComboFix, MBAM.... and a couple others. One of the residual problems was Action Center was missing from the notification area and I was able to...

General Discussion

Stuck on verifying DMI Pool after TDSS removal, can't repair OSI am using 64bit Pro. Core i7 920 12gb RAM, an eVGA X58 mobo
I had the TDSS/Alureon malware on my pc. It was redirecting most google traffic, playing background ads that could not be seen in task manager or closed in any way.
I downloaded some of the TDSSkiller etc files which did not seem...